1

I'm involved in a multi-tier project, one part of which is consuming a stream of "events" from a third-party system. The vendor is publishing these via an Azure Service Bus Topic - they provide, control & manage the Bus. We are simply provided with the URI, TopicName and Subscription details.

Our approach was to put together a Webjob, using the provided ServiceBusTrigger in the SDK to handle listening for new messages & triggering processing them into our system. However, we seem to have hit a roadblock in-so-much as the job continuously fails to read from the Topic. The job fails with a vague Timeout Exception:

Unhandled Exception: System.TimeoutException: The timeout elapsed upon attempting to obtain a token while accessing 'https://****-sb.accesscontrol.windows.net/WRAPv0.9/'. 
---> System.IdentityModel.Tokens.SecurityTokenException: The token provider was unable to provide a security token while accessing 'https://****-sb.accesscontrol.windows.net/WRAPv0.9/'. 
Token provider returned message: 'The operation has timed out'.

But further down, the trace includes:

[ERR] at Microsoft.ServiceBus.Common.AsyncResult.End[TAsyncResult](IAsyncResult result)
[ERR] at Microsoft.ServiceBus.NamespaceManager.OnEndTopicExists(IAsyncResult result)
[ERR] at Microsoft.ServiceBus.NamespaceManager.EndTopicExists(IAsyncResult result)

The vendor has subsequently confirmed that the only permission / claim the Subscription has on the Topic is Listen

Can anyone confirm what the permission requirements are for the ServiceBusTrigger?

And as a +1, on the assumption that it, for whatever reason, needs more the Listen (i.e needs Manage), would anyone like to suggest an alternative approach? It seems a shame to lose the WebJob infrastructure (the project already has 3 other jobs) - especially the loss of features like the async & concurrent processing of messages from the Topic

2 Answers 2

5

To close on this, we've made the suggested change to the WebJobs SDK (pull request here: https://github.com/Azure/azure-webjobs-sdk/pull/528). This will be in the next release. Here's an example of how you specify the AccessRights per attribute:

public static void JobFunction(
    [ServiceBusTrigger("inputqueue", AccessRights.Listen)] string message,
    [ServiceBus("outputqueue", AccessRights.Send)] out string message)
{
    . . .
}

When not specified, the default will be "Manage". When set to anything other than manage, the SDK will not attempt to create any SB resources. I assume this meets your needs?

1
  • Thanks Mathew. We've forged ahead with implementing our own wrapper around Topics for now, but it's far from perfect as we obviously have no dashboard integration, and some questions marks over graceful shutdown . We'll definitely revisit this in the near future once the above fix goes out in the stable release.
    – Ian
    Jun 13, 2015 at 6:40
1

The SDK makes the following call which would require Manage permission. Microsoft.Azure.WebJobs.ServiceBus.Listeners.NamespaceManagerExtensions. One alternative if you cannot set those permissions is to not use the SDK for the Service Bus Triggers but use it for everything else.

2
  • Thanks for the confirmation Pranav - I'll look to put something together using the MessageClient.OnMessageAsync() callback I would say that there is quite a compelling business use-case for supporting the Vendor-Client scenario where the Vendor only provides Listen to a given Topic (or Queue). I guess one option would be to add an Enum flag to the trigger attribute (MessageBusTriggerConnectionType.Managed / .Listener) - default to Managed to keep the current behaviour, but if set to Listener, skip any Topic Description / CreateIfNotExists calls
    – Ian
    Feb 24, 2015 at 7:18
  • Thank you for your suggestion. I will take it back to the team. Feb 24, 2015 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.